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(57) Abstract: 

PROBLEM TO BE SOLVED: To compress and store 
traffic data in a way as close as to that of packets set 
through a channel for the Internet or the like. 

SOLUTION: The traffic monitor device uses a packet 
acquisition module 2 to extract a packet through 
asynchronous transfer mode ATM lines 1, 12 of the 
Internet and to extract a header part including an IP 
header, which is given to a traffic data storage module 
3. Then the module 3 checks an outgoing/incoming 
network ID NID of the packet and a higher-ranking 
protocol of the IP from the header part, records the 
traffic data in a preset format based on the combination 
between the outgoing/incoming network ID and the 
higher-ranking protocol according to a preset format and 
stores the traffic data for each prescribed time while 
collecting the data of the same kind of the combination. 
Furthermore, the traffic data storage module 3 stores 
the traffic data having already been stored for the same 
kind while collecting the data for each same kind for 
each prescribed longer time. 
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U tettiLfc/^-y S^'>^< i & I P—y^^t^ 

sw^a^s 'o thLfz^ y ^gs^ortsa* h ms<-r y v 

&W^a#ttaiLfc^7 SW/^y S*{fWI*7 

I DSC^y 7 h#fSIM*7 M7-^ I DtOii^. 
3*b-£ («T\ «*M I Di^-S) «*N I D 

msssaio hf* •yt^m-rz?-? oxt, 
nt-esu -^b#pb1»c**n i D»si5i-aa<o s 7 

fc y^-^l^^iifcTSSN"* h7t 7?x-* 

[H*S(2] 8HEh7fc7*f*-*»ffl^aK:, 
N I DKAOx/C, s<try h*»^a^Sl9 ffi LfcWE^ 
7^«#eoflS;&>e>H/^7 ha»^a^tt£ULfc/^ 
7 h<7) I P/n hnyui t±fifcOD7 , n h=r/U (J^T\ 

£;ftfc7*-^7 f^EftU -£fl*IWSK**N I D 
i a S ayK^a^b-er^isj— ago h 7 fc 7 ^ 

NIDOftto?>{^ ^7>fc»^aaMK0fflLfcStrE 
^^^ffl^OrtS^^H^y hRW^adSttttSUfc^ 
^7 hOiite/B h a/USrH^c, iffi^n hayujiljfc, 
F7i ^7-^^f^^fc7^-r 7 hT?E» 

u — ©*iBfi^±fl[7'o h abasia— as<*> h 7 fc 7 

* 1 i-E&O K 7 fc 7 ^ g&gEg, 
[fll*S4] lftE_h{£:/n Nrr/uflTCP^n 

UDP/nhn/K HTTP/Bh=;K FTP7' 
n h^yu&tf SMTP^n Fn^5V>4< it lo 
T-fc* - i £ -T a W*3J 2 Xfl 3 KEtto N 7 t 

[i»**5] snEh7t y^^-^sa^ati, we 
i^— assfw^^^r^a^nfc S7 1 7^-r-^fi]± 

-a^gfc^ ^ tbxwm-tz z t **mkTzm#m 1 

a* 5> 4 i ^ixMCEttO h7t^ Et&^So 
(»*K6] teh7c:7^f-^ir, IP^a 
r*=/UKHrSflM8 («T. IP«f«iPf-5) , TCP' 

^nS3^!:Ht«)|« («T, TCPflMRtup-S) . 

UDP^^/H^t^M («T\ UDP««inf 

*< i i> 1 aS*^tf c t ^*»i:-t*5n*iS 1 35*6 5 
^•fn^^E®(7) I- 7 t 7 ^ ESSSft, 



(2) * M¥l 1 - 2 5 2 1 1 1 

2 

f»tt-5iB*:JS6«cE«tO Sy 7^SiS36Bo 

»J$n* - i*ftfS£-r*M#*f 6lcEttco ^'^ 7?E 

[«*3S9] WE = *^ va >JcPdu/j:^TC P»« 
£ LT'>*< i t»TC Pir^> v ^ftX^TCPi:^ 
/0 hft*^tfwfc&4#J*t"t-5W**8-;cE 
$£<7) S7fc 7^E«3fiflt 

[»*5l 0] ffJEa-t^-VaV^BHf 5TCPfflf« 
£ LT'>*< i *> = *^> 3 >»£^ifCi£*H8i"t- 

5 3 ic:lESc<7> N 7 fc 7 * E»S6B 0 

(W*«l 1] WEUD P««i: Lt*4< tisUD 

**tf^t*«F«i-rS«*iS6«CEttW h7 t: 7^E 

iw*isi 2] mzTyy r-isa >yu b^^mn 

20 tit, HTTP^nh3;H:Ht5m F T P7'c 
^=/K-Bi-t-S-|»«Xt^SMTP^a V^Mzm-t^ 

6 {-ISgcCO h7t7^ E^^g 0 
[0 00 1] 

^EsagimcBa-rs. 

[0 0 0 2] 

50 [&*0&fi?] -f>^-*7 hO*X(Cf#v\ #^(0[eI 
aSriffiixS K7 t 7^£O^P B 1^{t:*i\ ^f^-*7 

[0 0 0 3] dOi7tt/<7*«-- ^V^^*f$rff 5ic 
li, S»«raix-5 K7fc7^*fii*WEaLT, -eriC 
S^t^r*aoiRfH»«4r*fiSi-5iK»sfc* 0 

[0 0 0 4] — N7fc7^o»*«cf#t\ >fy^ 
*7 h^y^^-ySglfiATM (l^lBlKIMEai^- 
K : Asynchronous Transfer Mode) iBl'&tttiDi&M'iCJi 

40 [0 00 5] U^L, 0i»±«cSIEix5y^7 K€r*DI-& 

Sot, ATME«l<0«fc 9*r«iS*7 M7-^iC^Lr 

o*3is««>rJ!g*>5:*><oiiS a ^(Dtzab. ^S^E 
[0 0 0 6 ] 

[*M^*«:LJ:5i-r5ia!i] ^c-c^p^oaiii 
(sI»±lCSEixS/^7 i k J-T#-5fc*Jtifit^r-h7 

50 «ftt5"it*-5. 



(3) 



1 - 2 5 2 1 1 1 



[0 0 0 7] 

[HB*r*ft-*-*fc»!>©*g:] ±E»aB«:«R-#-SH* 

fliitiU ttiCLfc/^y r-(D-:l»i< th I p-. y y^ 
* r- Kft^&tfflk JIBLfc'v y 

hV-t I D&tf/<*y h*«(W*y bV-9 I Di(0 
■^y J-^EftU -£i*BS|:«»n i D#H-»3fo 
[0 0 0 8^4*:. W*qj2t«5*M«:. fitrfEr-7t 

y hSl#^S^ttfcbLfc^3' Nco I P7-D r-n/Wj: 9 
IS"*, *<fN I Di±&7*n h=yl/fl3ite^L-g-j»*-giJ|- % 

U -**Wfcfc**N IDi±f47n h=/wolfi^ 
*>fr^|5]-aig(D h 5 t y 9 <f— 9 I5]±£4 t *T#ffi 

1-5 r t zftmti-z b 7 1 y 9 

[0 0 0 9] 1***3 fcff5*«W:, mZbyty97 
3§j§N I DOftb9K. x^y S^f 

#ra-as© h ? t ^ ^ ia±sr4 1 «>T^s-r 5 

[0 0 10] R*94CfliS«Htt. Mfc±{$7a b=> 
^TCP7d|- 3 ;k UDPT'a f.=,u, HTTP7* 
nh=/K FTPrDha^SMTP^oFaAn 
5 < t *, 1 otfcS r t Zftmt-tZ V?±y9 

[0011] |ff*« 5 K&SSWIl. mibT-tyfif 

[0 0 12] »*«6SwflRS«M«:, mZbytyfT 
— 9 b LT. I P7*3 S=/w{cG31"*fl|« (glT, IP 
MBii*-*) , TCP^3S=^:at5f« («t. 
TCPtff«i:^) , UDP7 , 3 N=^iwBaf 5ff« 

(«T, UDPif«i^) Sy77'y7-y 3 y7' 3 

r^n-H-rsi** (wt, 77-V7-> 3 >/nsr, 



[0013] M**7 tffii«MI4, gtjfe j P ^ st L 
T'>*< t *, I P/<^ 7 M8»&cc I P/<. 7y .kjg^ 

[0 0 14] H*gi8tffi5*M«:, HMSTCPflmas 
a * * •> a VfcH L fct^T C P iffff t = * <? •> 3 >jcrj 
1-5 TC P*«tiCEM$ix5; i»iit 5 hy - „ 

w [0015] n#* 9 «riaa+^.> H> 

^raL^^TCPifffit Lt'M< ii,TCPt^> 
[0 0 16] 0t«5*«l4, ttE3*^-> 3 

[0017] ii*iii 15^5^11, flfriauDPff^ 

t UT'>4< i^UDP7 ; -^^7A^icS.i7UDP7 ? 

[0 0 18] ll^ili 2fcff5*Wi. eUfBTT-y-ir- 
'✓«^Bha^ftii / T. HTTP7*dFs/H:B 
FTPT-a Na/utBB-rsflMBa^SMTP 

i i -f 5 h 7 fc y ^ 4. 
[0 0 19] 

[0 020] (l>77^ ^tt^^OlSft^it) CO 

30 m&cr>Bm<Dmz b 7 y ?m&mm<oskftizbtz 9 , « 
(1) -^Bfr^s 1 o#g) ic. ip ( TC 

P, HTTP, FTPjySMTP (Simple Mail Tran 
sler Protocol .-^yyUpt-yi^^B 

cixtj^Sli, N!7-^ 1 DS. 

-#0 (2) -T *9-*y KOATMEI«±«:»h.5 i p^-?^- 
y h SrSl» L, -SB^O K y t y ^ h 7 t y 

9*-9k Lr»«r*. RfUJMBft. rox-^^Tc 

[0 0 2 1 ] 7^ggt;:ii, « 

[0 0 2 2] I Pfl|«:;o^-li. 
■50 (1) ATME**:glEii5»^y hRautJS^W h» 
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5 

(2) j5i«*yh7-^ IDS^y^ftacW 

(3) ±&(D7- b=*<omm<0'<lrv h-S&GVW 
-5 0 

[0 0 2 3] TC PtS^JCo^TIi, 

(1) SSSflfca^v/aVfe 

(2) a*^>3 ><75¥*&SttB#Pfl 

(3) 3*^*>a vSfc9osp*SSaS/^y h» 

(4) =*^->a vSfc9o¥*SSis^W KSt 

[0 0 2 4] HTTPtf&Ko^Tfi, JSSBi-T^ir^ 
[0 0 2 5] (SKtif/S) #h7fcy*E«3&Wi£i: 

[0 0 2 6] iiliOTf hyty^gggglfil 5 5 
Mb p s <D9S1 (OATME^l 1 2 O A TMIhMI 

1 2JC»lKSix, *<D±.iffiriZMJjfa<D'<tri/ bZW 

[0027] mx^-rx o^vyt y?$mm 

It I its h? = TSwJ:!K UNIX^-^CH 
SSS^S^y h»»^^-yu (^yUKW^S) 
2<bs zL-?-7u?yj*b LXmfZriZ by t 7*7* 

-?fa*^ a -/u (hjty^f-^i^a) 3ic 

[0 0 2 8IIC, h7fcy*E«3£»ltt, ISlOA 
TME&l lK««1-5fc»OATM#— K5i\ 112 
(DATMEifcll 2«cSftt-fSfcAOATM2R— K6 4r« 
fCt^*. Hi** 1 3XIM 4ttATM0*fc:SittS 
^ „l,5#*y h 7 — ^(OATM/U—^SfcltATM^-f y 

[0 0 2 9] (*^& ^a-/K;o^t) /^yh 

P, TCP. HTTP^O^y^g5£«:60fcBU h7 

[0 0 3 0] by fc ty^-r-^Sa^^a-zua-Ctt, 

[0 0 3 1 ] H4«-, S7 fc ^7-^(D7r- 77 h 
«ttf, h^fcy^x-^ti, -£B#Pflrt«;: 
^■■VT'f-^cFlxfc, ^ ID (5S*NI 

D : «N I D£«N I D) ) &0<«*#- b (well-know 
n tf-b :*W#-hS*t*«iW-h#*) #is]--c- 

[0 0 3 2] rooi: 5^-£8#BJrt(r<E5SSixfc18ftO 



U) % 4#M*P 1 1 - 2 5 2 1 1 1 

(5 

[0 0 3 3] «fH»«aor^v^-yU4ii, Sffi^rifc 

S 7 ^t-'— ^oo^lf^c^US^^^^T 9o :n::j; 
'0. Dc5*y S7-? I Da*iB = 1 ^BflKFTPiCJ: 
9 Sit Lfcf-5o8/<^ S^FTPt-/^ 
TCP^>'3 vfltfiC^afcLfclallftO 1 ilPflO^ 

[0034] *^7t7^siigint /^y sfta 
[0035] ( s 7 1 y ^ ssusb 1 (onmm) «t, 

0 2XO<EI 3 iclo'^t, >7 fc 7 ^-Eft&Kl 

[0 0 3 6] (/^7hS# : ?^--^2«a) $fe 
1\ 0 2*#SaU-C. '^y h&^^-vu2cOpMffl 

20 [0 0 3 7] /^yhW^'^-z^^ATM^-K 
5, 6 £iIL-CATMlH3«U K 12££81U ATM 
EliRl 1\ 1 2?5^^ri:«ri^^7 MrftlilLtt 
£ O^^^yz/S l#SB) o 
[0 0 3 8] '<!ry hft»e^=.-/u2 11, Jm 

IP U^-^yh^nhayU) <7)_tfi7'cr K 

: Transmission Control Protocol ) WUDP 
50 —- f -x— ^^7 A 7*0 h =3/u : User Datagram Pro toco 
I) 5 I P^7^^6^t 0 _b 

fi7'n hn/^TCP^fiUDP-efc^S^fl TCP 

^7t- ^y hSr«*fUr, 77'H-V 3 y7'nh 

[0 0 3 9] /^y hfe^v^-/u2l^ ±fa^J;9 
tC«ti?aUUfc I P-.7^W77'y^>3>7'n b=2 

. ;\,<n^y ygbftZ by fc y^-r— ^BIB^^a.— yu3^ 
[0 0 40] (h7t y^x— ^SfB^^a— /W30S¥ 

m <k'<^ m3%&mLx. bye 

[0 0 4 1] N7fc y^f-^tae^i-yUSli* 

£&rjt-r$ (IH3^fy7'S4#S) 0 
[0 0 4 2] -Sfl*P B 1^Siauiv^^(i, ^coPifK 

^7 S ^tl^ y a. - yU 2 ^ C nfCT - ^ ( I P— y 
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[0 0 4 3] V 'y^-^2frh^-9fr& 

f-^OID«:8St5 (7f-^S6#S) . S£L< 
**NID (***tx I D) 

[0 0 4 4] by fc ^7*— ?<D7sr— *y b t LX 
ft* **N I D&t«S*;tf- I P-/^y • 

I pflf*L TCPflMBXIiUDPflMB. Sfetf 
HTTPff*t^5 4aa<Offif«S:E»»fti:-f5 

[0 0 4 5] Sf, byt y$ s f-9^nrZ*/ s .-iVZ 
fts I Pttf«SrEft-f3 Uf^S 7#HB) . 
[0 04 6] I Ptt«<0g«ffli UTIi, TE ( 1 ) - 20 
(6) afcoi LT^3. 

(1) I P/^y M8* 

(2) i p^y h^-w 

(3) s<y-y KftO#* 

(4) IPy^Vyf-v/a^ 

fc^WSftfcl P'<^y M Sr^tf I Pa^* M8» 

(5) ^oha/H DStOI P/^y 

(6) ha/UI DgO I P^^y b& 

[0 0 4 7] ftC ^^^1*^^-^2^5)86* 50 
ixfc^y^ffl»^6, I P^Jbfiyn hn/^TCP, 
UDP, *tl$kft (I CMP W^-*yHfl^y 
t-'^nfs/i/: Internet Control Message Protoco 
I ) ^IGMP Wy^-t>^^-yfl7'DF3 
: Internet Group Management Protocol) 3?) eDi^-f 

[0 0 4 8] I P^)lfi/Ph3/^TCP^H 
Si\ =*^> 3 ^ilHL4^TCPfl»*«:E«rr5 
Ufy^S9#B) . 40 
[0 0 4 9] 3*^v3>S^HLJS^TCP«r«(Og¥a 
iL-CJi, TE (l) - (8) <oflJ«*:Sa-t-S4><oi 

C Pir^> hO^-f^i LTii* SY.W SYNtA 
CK, DT (-r-^-tr^ > h) , ACK, FIN 
-VM) , FIN (x-^JSL) , RSTs rn<bJ^ 
^<7)M ^^7'£08 oIwEB'J-f 2>. 
(1) TCPt^'>>.^t 50 



1 - 2 5 2 1 1 1 

5 

(2) TCP-ir^V bi&'U b$k (3**16]) 

(3) MSS (fcteir^ > Sf-fX : Maximum Segmen 
t Size) *7C/3V£*trTCP*^;*>NSN& 

ft) 

(4) WSF W^yK*^^-/U77^^ : Window S 
c 3 1 e Factor ) ^->3 v^tfTC P-fe^^ V KJ*ft 

(5) ^^A^^^ (Time Stamp) ^->3>*$tf 
TCPt^^h8ft CK*|6]) 

(6) ^TCPt^yh^c 

(7) *^9JOTCP"fe*'>>h«» (S*r»j) 

(8) ^^^'JOTCPir^^V bt&'U h» 
ft) 

[0 0 5 0] ft{w, h7t^r-^fg^^-/U3 

10 IMS) o Bttfctt:, h7 t7^7-^IS^a- 

T*5 9, ttBLt^y h(OTCP/l P^y^5)J5 
m<D I P7K^RIH5*<0*- h#^»ffit5rt 
9, *-<Ds<*-y hOTCP=*^3 v£H«'JU 

^i/H^ID^6#t^ BW5iJUfcTCP=*^->3 
V36S = * ^ i/ 3 v^Sx-t^cd y * h t N^ii, 
S8TC P3*^*>3 lf-^/U: 

[0 0 5 1] tit, F7t7^f-^ta^a»;u 

£ff 3 Ur^S 1 l#SB) . B»fc:ii, *^R»L 
f;TCP3^^y 3 y|:StLT, SBLfc/^yhOT 
CP^y^«:A*tLT4*.5ci:^J:9, #1B9»& 
tT^o TCPOttlltLm CLOSED (3*^i/3^4 

L) , S YN SENT (SYNSff $F30 . ESTABLISHED^-* 

CiS*) s IHIT_FIN_SENT(FINSHiaF*) STORES _F 

in sent (fin at**) o5««*K*j-*-st>0>i: 

[0 0 5 21 F7 fc y* s r—*W&=ei?a.-j\'3 

It, a y|:Bt5 T C Pfll«*i8tS (^x 

e>K«Tcp*«(osa*ff 5. 

[0 0 5 3] =*^-> 3 >'tcia-r5TCP««4:U-C 
tt, TE (1) - (6) 0*«««t$?,OiLt^ 

5 0 cito^ s*i»ittt, +-^»»&<oas«t, ^ 

(1) Tcp=*^->3>aficric5&ft 

(2) TCP3^^y 3 yS4*» 

(3) TCP=*^->3>aacsp*sB$p B i 

(4) TCP=*^->3>#iR2p*&B*Pfl 

(5) TCP^^^yH v^co^^v^-^^^l: 
f»J) 

(6) TCP3*^y3>S07yu-y-yh (2X*fS]) 
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[0 0 5 4] h7r'^7-^^y^-^3 * 

= Srll^S Ufy^S I 3 #») . »»iCfi, # 

[0 0 5 5] tit, TCPl(077'^->3>7'3 

>3 y7"= K = ^HTT P (Hyper Text fransfer Pro 
toco I :^*fX— S*5aS7 , = S =yu) T-£>5#b 

[0 0 5 6 ] TCP±OT p 7 , y-5r— >3^B*T<Ottf«Sr 
[0 0 5 7] IPOiffi/oSa/U^ffi Uf 

jDPft«*ssir5 Ufy/s 1 5 mm . 

[0 0 5 8] UD PtSffit L*CfiTl£ (l) - (2) <0 

(1) UDPf-;^7A8» 0^7 ft) 

(2) h« (MX fa) 

[0 0 5 9] IC, hyty^f-^l^^-/^ 
ft, UD P1W77' !) ^r->3 y^n h a/i/SiR- h# 
*^<fc 9 5S6J5U LXZ<DT7y*-isa>BG<Oft»&ffir 

(^yi/S 1 6#SB) o 

[0 0 6 0] UD P±(077'!) ^-*>a 

[0 0 6 1] I P<D±fc/a h3/U<0*|£ Ufy^S 
8) Kfc^TiffiT'n hayuaSTCP-Cfc. UDPtfe 

[0 0 6 2] -t IT, ffiBSi-^t-S^PfldsSia Lit 

[0063] ffisst itfi i d#h-«so h 

[H2] 
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[0 0 6 4] t aTJBHSSixfc ^7i7 

10 fi^ ^7 t y^-r-^JC/EffiL-C*)^^. 

[0 0 6 5] ±ieKMT-tt, h7fc*^ g£&£lit 1 
>?-*y hfOATM[£]«li-Sic$rvr^^/iv AT 

[0 0 6 6] 

mi] **§Bconi6(?D)gffifw«5 k 7 1 y ^gaasa 
[m 2 ] hs«¥aotoa^j««ij*^-ria. 

[03] h 7 b y ^f'-^SiBl^aoteS^MSffll^^i- 
IB. 

[HI 4] h7 fc 7^f-?07^y HH**-fBI 0 
50 1 h5fcy*e«»B 

2 ^7 MUfl^e^^-^ y hft#m 

3 hyt^^f-^fg^^a-yu (^7t 7^7^— 

4 m^muju^e^^-^ 

5. 6 ATMUJj^ 

7 h7 t 7^7^— ^7* — h 

IK 12 ATM^-K 

13. 14 ATM^^XHATM^-fyf 
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